@deepstrike/sdk 0.2.41 → 0.2.43

package/README.md

@@ -245,7 +245,7 @@ A node's `kind` selects the control-flow shape; the same executor drives them al
 
 ### 0.2.11 capabilities
 
-- **Runtime fan-out** — give a node the `submitWorkflowNodesTool` and its agent can append nodes to the live DAG mid-run (true loop-until-done; one verifier per claim it discovers). Recorded and replayed on `resumeWorkflow`.
+- **Runtime fan-out** — give a node the `submitWorkflowNodesTool` and its agent can append nodes to the live DAG mid-run (true loop-until-done; one verifier per claim it discovers). Recorded and replayed on `resumeWorkflow`. Governance rejection fails the submitting node instead of acknowledging work that was never appended.
 - **Quarantine, no escape** — set `trust: "quarantined"` on a node that reads untrusted content; it's denied write-capable isolation in-kernel, and any nodes it submits are coerced to quarantined too (no privilege escalation).
 - **Structured output** — set `outputSchema` on a node; the runner instructs the agent, validates the result against the JSON-Schema subset, and re-runs once with the errors on mismatch. A node that never conforms fails (its dependents starve).
 - **Budget as signal** — with a `maxWorkflowNodes` / `maxConcurrentSubagents` quota installed, each spawned node's goal carries its remaining headroom so a coordinator can size its fan-out to fit.
@@ -719,7 +719,7 @@ for await (const evt of runner.spawnSubAgent({
 }
 ```
 
-Requires an active parent run (`run()` / `wake()` in progress). The kernel emits `agent_process_changed`; the default `SubAgentOrchestrator` runs the child with a filtered execution plane and feeds `sub_agent_completed` back.
+Requires an active parent run (`run()` / `wake()` in progress). The kernel emits `agent_process_changed`; the default `SubAgentOrchestrator` runs the child with a filtered execution plane and feeds `sub_agent_completed` back. If governance rejects the spawn before execution, the iterator yields one `error` event containing the denial reason; the parent turn is not rolled back.
 
 ---
 

package/dist/governance.d.ts

@@ -30,11 +30,10 @@ export interface GovernancePolicy {
     }[];
     constraints?: GovernanceConstraint[];
     /** I5: when true (default), the runner pre-filters denied tools out of the schema passed to the
-     *  provider — the model never sees them and never tries to call them, eliminating the rollback
-     *  turn the kernel would otherwise produce. The denied tool names are also surfaced as a single
-     *  line on the system slot so the model knows not to plan around them. Set to false to fall
-     *  back to the v0.2.22 rollback-based behavior (useful for measuring the delta or when the
-     *  agent should learn the denial via a real attempt). */
+     *  provider — the model never sees them and never tries to call them. The denied tool names are
+     *  also surfaced as a single line on the system slot so the model knows not to plan around them.
+     *  Set to false when the agent should learn the denial through a real attempted call and its
+     *  visible error tool result. */
     surfaceDeniedInSystem?: boolean;
 }
 /** I5: walk the tool list and bucket each tool into `allowed` / `denied` based on a declarative

package/dist/harness/harness.d.ts

@@ -1,5 +1,6 @@
 import type { RuntimeRunner } from "../runtime/runner.js";
 import type { SessionEvent } from "../runtime/session-log.js";
+import type { ContentPart } from "../types.js";
 import type { WorkflowNodeSpec } from "../types/agent.js";
 import type { Criterion, Verdict } from "../runtime/eval.js";
 import type { AttemptJudge, JudgeResult } from "./judge.js";
@@ -8,6 +9,12 @@ export interface AttemptRequest {
     sessionId?: string;
     goal: string;
     criteria?: Criterion[];
+    /**
+     * Multimodal inputs (images / audio) attached to the task. Forwarded to every attempt
+     * unconditionally; the runner seeds them per session idempotently, so fresh-session carries
+     * re-seed while same-session carries do not double.
+     */
+    attachments?: ContentPart[];
     extensions?: Record<string, unknown>;
     /** Parent transcript inherited by the first attempt only. */
     inheritEvents?: Array<{

package/dist/harness/harness.js

@@ -14,6 +14,7 @@ export class RuntimeAttemptBody {
             sessionId: context.sessionId,
             goal: context.goal,
             criteria: (context.criteria ?? []).map(criterion => criterion.text),
+            ...(context.attachments?.length ? { attachments: context.attachments } : {}),
             extensions: context.extensions,
             ...(context.attempt === 1 && context.inheritEvents
                 ? { inheritEvents: context.inheritEvents }

package/dist/kernel.d.ts

@@ -25,6 +25,8 @@ export interface ResourceQuota {
     maxTotalSubagents?: number;
     /** Max sub-agent nesting depth (direct children of the root loop are depth 1). */
     maxSpawnDepth?: number;
+    /** Max nodes in one in-kernel workflow DAG, including dynamically submitted nodes. */
+    maxWorkflowNodes?: number;
     /** Rolling-window memory-write rate limit: at most `maxWrites` per any `windowMs` span. */
     memoryWritesPerWindow?: MemoryWriteRateLimit;
 }
@@ -50,6 +52,9 @@ export interface MemoryPolicy {
     maxContentBytes?: number;
     /** Override the kernel's `write_memory` name-length limit. */
     maxNameLength?: number;
+    /** M4: recall count at which the kernel emits an advisory (edge-triggered)
+     *  `promotion_suggested` for a recalled record. Omitted = suggestions disabled. */
+    promotionRecallThreshold?: number;
 }
 export interface GovernanceInstance {
     setIdentity(agentId: string, sessionId: string): void;

package/dist/runtime/kernel-step.d.ts

@@ -157,6 +157,9 @@ export type KernelRunnerAction = {
 };
 export interface KernelObservation {
     kind: string;
+    /** control_request_rejected: stable control-plane operation name and optional subject id. */
+    operation?: string;
+    subject?: string;
     action?: string;
     rho_after?: number;
     sprint?: number;

package/dist/runtime/runner.d.ts

@@ -374,6 +374,23 @@ export declare class RuntimeRunner {
     private commitKernelAction;
     private persistMemoryToStore;
     private retrieveMemoryFromStore;
+    /**
+     * T5: run one memory query through the kernel's `query_memory → memory_query_result`
+     * effect lifecycle on the given runtime. The kernel injects each routed hit into history
+     * itself and derives the recall lifecycle (`memory_recalled`, edge-triggered
+     * `promotion_suggested`) from the routed hits — the store stays a pure query.
+     *
+     * `seenRecordIds` is one dedupe horizon: a record hit by several queries of the same
+     * prefetch is routed (recalled, injected) once. The kernel derives counts statelessly from
+     * each hit's payload, so host-side pre-filtering is the only place duplicates can be stopped.
+     *
+     * The recall lifecycle is consumed immediately rather than via the per-turn drain: the store
+     * must be up to date before any same-turn re-query, and a renewal prefetch fires inside the
+     * drain loop where queued observations would not be consumed until the next boundary.
+     * Non-memory observations are forwarded to `leftovers` (the run's pending queue) when given,
+     * and discarded for detached syscall runtimes (their kernel is throwaway).
+     */
+    private queryMemoryThroughKernel;
     writeMemory(memory: MemoryRecord, opts?: {
         sessionId?: string;
         agentId?: string;
@@ -394,7 +411,17 @@ export declare class RuntimeRunner {
      * every policy from the first spawn. No config ⇒ the native-profile defaults (铁律: defaults only).
      */
     private applyKernelPolicies;
-    private appendMemorySyscallObservations;
+    /**
+     * Mirror one kernel memory-lifecycle observation into the durable store / host callbacks.
+     * Shared by the main run drain, the prefetch path, and the host memory syscalls so every
+     * query route has identical recall + promotion semantics (T5).
+     *
+     * M3: `memory_recalled` carries the kernel-derived count — the runner never computes
+     * `recall_count + 1` itself. M4: `promotion_suggested` is advisory and already
+     * edge-triggered by the kernel; the runner surfaces it and never auto-pins.
+     */
+    private mirrorMemoryLifecycle;
+    private consumeMemoryLifecycleObservations;
     /** Mount a tool capability on the currently-running kernel runtime. No-op if not running. */
     mountTool(schema: ToolSchema): Promise<void>;
     /** Mount a skill capability on the currently-running kernel runtime. No-op if not running. */

package/dist/runtime/runner.js

@@ -34,6 +34,25 @@ export function schedulerPolicyToKernel(policy) {
         token_cost_weight: policy.tokenCostWeight,
     };
 }
+/** Kernel observation kinds owned by the memory lifecycle consumer (journal + store mirror). */
+function isMemoryLifecycleObservation(obs) {
+    return obs.kind === "memory_written"
+        || obs.kind === "memory_queried"
+        || obs.kind === "memory_validation_failed"
+        || obs.kind === "memory_recalled"
+        || obs.kind === "promotion_suggested";
+}
+function controlRequestRejection(observations, operation) {
+    const rejected = observations.find(observation => observation.kind === "control_request_rejected"
+        && (!operation || observation.operation === operation));
+    if (!rejected)
+        return undefined;
+    return {
+        operation: rejected.operation ?? operation ?? "control_request",
+        ...(rejected.subject ? { subject: rejected.subject } : {}),
+        reason: typeof rejected.reason === "string" ? rejected.reason : "request denied",
+    };
+}
 function pendingCallIds(action) {
     switch (action.kind) {
         case "call_provider":
@@ -126,6 +145,66 @@ export class RuntimeRunner {
         return (await this.opts.dreamStore.search(agentId, { ...query, top_k: requestedK }))
             .slice(0, requestedK);
     }
+    /**
+     * T5: run one memory query through the kernel's `query_memory → memory_query_result`
+     * effect lifecycle on the given runtime. The kernel injects each routed hit into history
+     * itself and derives the recall lifecycle (`memory_recalled`, edge-triggered
+     * `promotion_suggested`) from the routed hits — the store stays a pure query.
+     *
+     * `seenRecordIds` is one dedupe horizon: a record hit by several queries of the same
+     * prefetch is routed (recalled, injected) once. The kernel derives counts statelessly from
+     * each hit's payload, so host-side pre-filtering is the only place duplicates can be stopped.
+     *
+     * The recall lifecycle is consumed immediately rather than via the per-turn drain: the store
+     * must be up to date before any same-turn re-query, and a renewal prefetch fires inside the
+     * drain loop where queued observations would not be consumed until the next boundary.
+     * Non-memory observations are forwarded to `leftovers` (the run's pending queue) when given,
+     * and discarded for detached syscall runtimes (their kernel is throwaway).
+     */
+    async queryMemoryThroughKernel(runtime, query, agentId, sessionId, seenRecordIds, leftovers) {
+        const observations = [];
+        const action = await this.commitKernelAction(runtime, observations, { kind: "query_memory", query }, sessionId);
+        if (action.kind !== "query_memory") {
+            throw new Error(`query_memory returned unexpected kernel effect: ${action.kind}`);
+        }
+        let hits = [];
+        let ioError;
+        try {
+            hits = await this.retrieveMemoryFromStore(query, action.requestedK, agentId);
+            if (seenRecordIds) {
+                hits = hits.filter(hit => {
+                    const id = hit.record.record_id;
+                    if (seenRecordIds.has(id))
+                        return false;
+                    seenRecordIds.add(id);
+                    return true;
+                });
+            }
+        }
+        catch (cause) {
+            ioError = cause;
+        }
+        // Close the kernel effect even when the store failed — never leave a dangling query.
+        // The result commit resumes the kernel's reasoning path (`resume_after_preload`), which
+        // re-emits the next loop action with the routed hits now in history — callers on a live
+        // run kernel must adopt it (a query is a preload, not a detached side-channel).
+        const resumed = await this.commitKernelMaybeAction(runtime, observations, {
+            kind: "memory_query_result",
+            effect_id: action.effectId,
+            hits,
+            ...(ioError ? { error: formatToolError(ioError) } : {}),
+        }, sessionId);
+        await this.consumeMemoryLifecycleObservations(sessionId, observations);
+        if (leftovers) {
+            for (const obs of observations) {
+                if (!isMemoryLifecycleObservation(obs))
+                    leftovers.push(obs);
+            }
+        }
+        if (ioError)
+            throw ioError;
+        return { hits, action: resumed };
+    }
     async writeMemory(memory, opts = {}) {
         const sessionId = opts.sessionId ?? this.currentSessionId;
         const agentId = opts.agentId ?? this.opts.agentId;
@@ -136,7 +215,7 @@ export class RuntimeRunner {
         const runtime = this.createSyscallRuntime();
         const action = await this.commitKernelMaybeAction(runtime, observations, { kind: "write_memory", memory }, durableSessionId);
         if (!action) {
-            await this.appendMemorySyscallObservations(sessionId, observations);
+            await this.consumeMemoryLifecycleObservations(sessionId, observations);
             return;
         }
         if (action.kind !== "persist_memory") {
@@ -154,7 +233,7 @@ export class RuntimeRunner {
             effect_id: action.effectId,
             ...(ioError ? { error: formatToolError(ioError) } : {}),
         }, durableSessionId);
-        await this.appendMemorySyscallObservations(durableSessionId, observations);
+        await this.consumeMemoryLifecycleObservations(durableSessionId, observations);
         if (ioError)
             throw ioError;
     }
@@ -164,29 +243,11 @@ export class RuntimeRunner {
         if (!this.opts.dreamStore || !agentId)
             return [];
         const durableSessionId = this.durableSessionId(sessionId);
-        const observations = [];
+        // Detached syscall runtime: the kernel's history injection and resumed action are inert
+        // (the kernel is throwaway), but the recall lifecycle is identical to an in-run query
+        // (T5 parity).
         const runtime = this.createSyscallRuntime();
-        const action = await this.commitKernelAction(runtime, observations, { kind: "query_memory", query }, durableSessionId);
-        if (action.kind !== "query_memory") {
-            throw new Error(`query_memory returned unexpected kernel effect: ${action.kind}`);
-        }
-        let hits = [];
-        let ioError;
-        try {
-            hits = await this.retrieveMemoryFromStore(query, action.requestedK, agentId);
-        }
-        catch (cause) {
-            ioError = cause;
-        }
-        await this.commitKernelApply(runtime, observations, {
-            kind: "memory_query_result",
-            effect_id: action.effectId,
-            hits,
-            ...(ioError ? { error: formatToolError(ioError) } : {}),
-        }, durableSessionId);
-        await this.appendMemorySyscallObservations(durableSessionId, observations);
-        if (ioError)
-            throw ioError;
+        const { hits } = await this.queryMemoryThroughKernel(runtime, query, agentId, durableSessionId);
         await this.logMemoryRetrievalResult(durableSessionId, hits);
         return hits;
     }
@@ -322,6 +383,7 @@ export class RuntimeRunner {
                 ...(q.maxConcurrentSubagents !== undefined ? { max_concurrent_subagents: q.maxConcurrentSubagents } : {}),
                 ...(q.maxTotalSubagents !== undefined ? { max_total_subagents: q.maxTotalSubagents } : {}),
                 ...(q.maxSpawnDepth !== undefined ? { max_spawn_depth: q.maxSpawnDepth } : {}),
+                ...(q.maxWorkflowNodes !== undefined ? { max_workflow_nodes: q.maxWorkflowNodes } : {}),
                 ...(q.memoryWritesPerWindow !== undefined
                     ? { memory_writes_per_window: [q.memoryWritesPerWindow.maxWrites, q.memoryWritesPerWindow.windowMs] }
                     : {}),
@@ -371,14 +433,36 @@ export class RuntimeRunner {
         }
         await this.commitKernelApply(runtime, this.pendingObservations, { kind: "configure_run", config });
     }
-    async appendMemorySyscallObservations(sessionId, observations) {
-        if (!sessionId)
-            return;
+    /**
+     * Mirror one kernel memory-lifecycle observation into the durable store / host callbacks.
+     * Shared by the main run drain, the prefetch path, and the host memory syscalls so every
+     * query route has identical recall + promotion semantics (T5).
+     *
+     * M3: `memory_recalled` carries the kernel-derived count — the runner never computes
+     * `recall_count + 1` itself. M4: `promotion_suggested` is advisory and already
+     * edge-triggered by the kernel; the runner surfaces it and never auto-pins.
+     */
+    async mirrorMemoryLifecycle(obs) {
+        if (obs.kind === "memory_recalled" && obs.recalls?.length) {
+            const agentId = this.opts.agentId;
+            if (agentId && this.opts.dreamStore?.recordRecall) {
+                await this.opts.dreamStore.recordRecall(agentId, obs.recalls);
+            }
+        }
+        if (obs.kind === "promotion_suggested" && obs.record_id) {
+            this.opts.onPromotionSuggested?.({
+                recordId: obs.record_id,
+                recallCount: obs.recall_count ?? 0,
+            });
+        }
+    }
+    async consumeMemoryLifecycleObservations(sessionId, observations) {
         const turn = this.activeKernel?.turn() ?? 0;
         for (const obs of observations) {
-            if (obs.kind !== "memory_written"
-                && obs.kind !== "memory_queried"
-                && obs.kind !== "memory_validation_failed")
+            if (!isMemoryLifecycleObservation(obs))
+                continue;
+            await this.mirrorMemoryLifecycle(obs);
+            if (!sessionId)
                 continue;
             const event = kernelObservationToSessionEvent(obs, turn);
             if (event)
@@ -459,8 +543,14 @@ export class RuntimeRunner {
         });
         this.nextArchiveStart = await this.appendObservations(parentSessionId, runtime, this.nextArchiveStart);
         const spawned = findSpawnProcessObservation(observations);
-        if (!spawned)
+        if (!spawned) {
+            const rejected = controlRequestRejection(observations, "spawn_sub_agent");
+            if (rejected) {
+                yield { type: "error", message: `spawn_sub_agent denied: ${rejected.reason}` };
+                return;
+            }
             throw new Error("spawn_sub_agent did not emit agent_process_changed");
+        }
         const manifest = spawnObservationToManifest(spawned, spec, parentSessionId);
         const orchestrator = this.opts.subAgentOrchestrator ?? defaultSubAgentOrchestrator;
         const result = await orchestrator.run({
@@ -856,6 +946,11 @@ export class RuntimeRunner {
         }
         if (!initialAction)
             return { nodeOutcomes: [], outputs: {} };
+        const workflowRejection = controlRequestRejection(observations);
+        if (initialAction.kind === "call_provider" && workflowRejection) {
+            this.workflowContinuation = initialAction;
+            return { nodeOutcomes: [], outputs: {}, rejection: workflowRejection };
+        }
         if (initialAction.kind !== "spawn_workflow") {
             throw new Error(`workflow load returned unexpected kernel effect: ${initialAction.kind}`);
         }
@@ -915,6 +1010,21 @@ export class RuntimeRunner {
                     const observationStart = this.pendingObservations.length;
                     const submitAction = await this.commitKernelMaybeAction(runtime, this.pendingObservations, submitEvent);
                     const subObs = this.pendingObservations.slice(observationStart);
+                    const rejected = controlRequestRejection(subObs, "submit_workflow_nodes")
+                        ?? (subObs.find(o => o.kind === "nodes_rejected")
+                            ? { operation: "submit_workflow_nodes", reason: String(subObs.find(o => o.kind === "nodes_rejected")?.reason ?? "request denied") }
+                            : undefined);
+                    if (rejected) {
+                        const denial = `workflow node submission denied: ${rejected.reason}`;
+                        result.result = {
+                            ...result.result,
+                            termination: "error",
+                            finalMessage: { role: "assistant", content: denial, toolCalls: [] },
+                        };
+                        outputs.set(result.agentId, denial);
+                        if (stableId !== result.agentId)
+                            outputs.set(stableId, denial);
+                    }
                     if (submitAction?.kind === "spawn_workflow") {
                         nextNodes.push(...submitAction.nodes);
                         budget = submitAction.budget ?? budget;
@@ -1098,6 +1208,12 @@ export class RuntimeRunner {
         const runId = midRun && resumedStart?.event.kind === "run_started"
             ? resumedStart.event.run_id
             : crypto.randomUUID();
+        // Idempotent per session: an earlier run's `run_started` already carries these attachments
+        // (same-session retry attempt), so replay reconstructs them — recording and seeding again
+        // would double them in history. Deduping at the append keeps live and replay in agreement.
+        const attachments = req.attachments?.length && !attachmentsAlreadySeeded(prior, req.attachments)
+            ? req.attachments
+            : undefined;
         if (!midRun) {
             await this.opts.sessionLog.append(req.sessionId, {
                 kind: "run_started",
@@ -1106,10 +1222,10 @@ export class RuntimeRunner {
                 criteria: req.criteria ?? [],
                 agent_id: this.opts.agentId,
                 system_prompt: this.opts.systemPrompt,
-                ...(req.attachments?.length ? { attachments: req.attachments } : {}),
+                ...(attachments ? { attachments } : {}),
             });
         }
-        yield* this.execute(req.sessionId, req.goal, req.criteria ?? [], req.extensions, prior.length > 0 ? prior : undefined, midRun, req.attachments, runId);
+        yield* this.execute(req.sessionId, req.goal, req.criteria ?? [], req.extensions, prior.length > 0 ? prior : undefined, midRun, attachments, runId);
     }
     async *wake(sessionId, extensions) {
         const events = await this.opts.sessionLog.read(sessionId);
@@ -1356,6 +1472,9 @@ export class RuntimeRunner {
                     ...(m.validationEnabled !== undefined ? { validation_enabled: m.validationEnabled } : {}),
                     ...(m.maxContentBytes !== undefined ? { max_content_bytes: m.maxContentBytes } : {}),
                     ...(m.maxNameLength !== undefined ? { max_name_length: m.maxNameLength } : {}),
+                    ...(m.promotionRecallThreshold !== undefined
+                        ? { promotion_recall_threshold: m.promotionRecallThreshold }
+                        : {}),
                 });
             }
             if (this.opts.knowledgeSource) {
@@ -1465,21 +1584,24 @@ export class RuntimeRunner {
                     message: attachmentsToKernelMessage(attachments),
                 });
             }
-            // I4: pre-fetch memory before the first LLM turn so the model sees it on turn 1 instead of
-            // discovering it via the `memory` tool on turn 3+. Skipped on resumes (already in prior
-            // context) and when dreamStore/agentId is absent.
-            //
-            // Strict dynamic context control: this is single-use retrieval content (facts relevant to
-            // THIS run's goal right now), not a stable method/skill — so it lands in `history` as an
-            // ordinary turn, exactly like a real `memory` tool result would, and decays with the
-            // compression pyramid over subsequent turns instead of pinning itself in `knowledge` forever.
             this.currentGoal = goal;
-            if (!resumeMidRun) {
-                await this.prefetchMemoryIntoHistory(runtime, "initial");
-            }
             let action = resumeMidRun
                 ? await this.commitKernelAction(runtime, this.pendingObservations, { kind: "resume" })
                 : await this.commitKernelAction(runtime, this.pendingObservations, startPayload);
+            // I4/T5: pre-fetch memory before the first LLM turn so the model sees it on turn 1 instead
+            // of discovering it via the `memory` tool on turn 3+. It routes through the kernel's
+            // query_memory lifecycle and therefore runs AFTER start_run — a memory query is a kernel
+            // preload whose result resumes the reasoning path, so issuing it pre-run would leave the
+            // kernel Running and start_run would fault. The resumed action from the last query
+            // supersedes start_run's (same pull contract; it renders the injected hits). Hits land in
+            // `history` as ordinary turns — single-use retrieval content that decays with the
+            // compression pyramid, never pinned into `knowledge`. Skipped on resumes (already in
+            // prior context) and when dreamStore/agentId is absent.
+            if (!resumeMidRun) {
+                const resumed = await this.prefetchMemoryIntoHistory(runtime, "initial");
+                if (resumed)
+                    action = resumed;
+            }
             // P0-C: the skill loaded and in effect going into the current turn (updated when the model's
             // `skill` tool call resolves). Drives the per-turn `activeSkill` metric → dwell measurement.
             let activeSkill;
@@ -1842,7 +1964,7 @@ export class RuntimeRunner {
                                 const spec = parseStartWorkflowSpec(call.arguments);
                                 if (spec) {
                                     this.pendingAuthoredWorkflows.push(spec);
-                                    const out = "workflow authored; executing now";
+                                    const out = "workflow submitted for governance adjudication";
                                     toolResults.push({ callId: call.id, output: out, isError: false });
                                     yield { type: "tool_result", callId: call.id, content: out, isError: false };
                                     continue;
@@ -1853,13 +1975,13 @@ export class RuntimeRunner {
                                 ? parseStartWorkflowArgs(call.arguments)
                                 : parseSubmitWorkflowNodesArgs(call.arguments);
                             yield { type: "workflow_nodes_submitted", nodes };
-                            const result = { callId: call.id, output: "submitted", isError: false };
+                            const result = { callId: call.id, output: "workflow nodes submitted for parent governance adjudication", isError: false };
                             toolResults.push(result);
-                            yield { type: "tool_result", callId: call.id, content: "submitted", isError: false };
+                            yield { type: "tool_result", callId: call.id, content: result.output, isError: false };
                         }
                         // O5 (PreToolUse-hook analog): give the host a STATEFUL veto over each kernel-approved
-                        // call. A blocked call never executes; its reason reaches the model as a governance-denied
-                        // tool result (the kernel rolls the turn back with the note). Decision failures are closed
+                        // call. A blocked call never executes; its reason reaches the model as a committed
+                        // governance-denied tool result. Decision failures are closed
                         // unless the host explicitly marks this hook advisory with `onToolCallFailure: "open"`.
                         let executableCalls = normalCalls;
                         if (this.opts.onToolCall) {
@@ -2195,7 +2317,7 @@ export class RuntimeRunner {
      *  earlier memory hits, so the new sprint gets a fresh recall pass. Errs-open throughout. */
     async prefetchMemoryIntoHistory(runtime, phase) {
         if (!this.opts.dreamStore || !this.opts.agentId || !this.opts.memoryScope)
-            return;
+            return undefined;
         // P10: recall is default-on (CC session-start recall) — with no hook configured,
         // the goal itself is the query. preQueryMemory stays as the targeting override.
         const preQuery = this.opts.preQueryMemory
@@ -2211,23 +2333,27 @@ export class RuntimeRunner {
                 runSpec: this.opts.runSpec,
                 phase,
             });
-            const lines = [];
+            // T5: route each query through the kernel's query_memory lifecycle instead of calling
+            // the store directly — the kernel injects each routed hit into history itself and the
+            // recall lifecycle (recordRecall / promotion) fires exactly like an in-run query.
+            //
+            // One prefetch = one dedupe horizon: a record hit by several short queries recalls and
+            // injects once. A renewal prefetch starts a fresh horizon — renewal dropped the earlier
+            // injection with the old history, so re-exposure is a genuine new recall.
+            const seenRecordIds = new Set();
+            let resumed;
             for (const q of queries ?? []) {
                 if (!q.query.trim())
                     continue;
-                const hits = await this.opts.dreamStore.search(this.opts.agentId, q);
-                for (const hit of hits) {
-                    lines.push(`[memory record_id=${hit.record.record_id} trust=${hit.record.provenance.trust} score=${hit.score.toFixed(3)}] ${hit.record.content}`);
-                }
-            }
-            if (lines.length > 0) {
-                await this.commitKernelApply(runtime, this.pendingObservations, {
-                    kind: "add_history_message",
-                    message: { role: "user", content: lines.join("\n") },
-                });
+                const { action } = await this.queryMemoryThroughKernel(runtime, q, this.opts.agentId, this.durableSessionId(this.currentSessionId), seenRecordIds, this.pendingObservations);
+                resumed = action ?? resumed;
             }
+            // Each memory_query_result resumes the reasoning path and re-emits the pending loop
+            // action; the caller must continue from the LAST one (it renders the injected hits).
+            return resumed;
         }
         catch { /* errs-open — a faulty pre-fetch never breaks the run */ }
+        return undefined;
     }
     async appendObservations(sessionId, runtime, nextArchiveStart, _taskScope) {
         const turn = runtime.turn();
@@ -2248,22 +2374,9 @@ export class RuntimeRunner {
                 });
                 this.activeGroupBudgetScope = undefined;
             }
-            // M3: mirror the kernel's journaled recall lifecycle into the durable store so recall
-            // history (count + last-recalled turn) survives across sessions.
-            if (obs.kind === "memory_recalled" && obs.recalls?.length) {
-                const agentId = this.opts.agentId;
-                if (agentId && this.opts.dreamStore?.recordRecall) {
-                    await this.opts.dreamStore.recordRecall(agentId, obs.recalls);
-                }
-            }
-            // M4: a recall crossed the promotion threshold. Advisory — surface it for the host/model to
-            // act on (pin or promote to knowledge); the runner does not auto-pin.
-            if (obs.kind === "promotion_suggested" && obs.record_id) {
-                this.opts.onPromotionSuggested?.({
-                    recordId: obs.record_id,
-                    recallCount: obs.recall_count ?? 0,
-                });
-            }
+            // M3/M4: mirror the kernel's journaled recall lifecycle into the durable store /
+            // host callbacks (shared consumer — identical semantics on every query route).
+            await this.mirrorMemoryLifecycle(obs);
             const latest = obs.kind === "compressed" ? await this.opts.sessionLog.latestSeq(sessionId) : undefined;
             const event = kernelObservationToSessionEvent(obs, turn, {
                 nextArchiveStart,
@@ -2360,6 +2473,15 @@ function isMidRun(events) {
     }
     return lastStarted >= 0 && lastStarted > lastTerminal;
 }
+/**
+ * True when an earlier run in this session already seeded the same attachments. Replay
+ * reconstructs the attachment message from that run's `run_started`, so recording and
+ * live-seeding them again (a same-session retry attempt) would double them in history.
+ */
+function attachmentsAlreadySeeded(prior, attachments) {
+    const wanted = JSON.stringify(attachments);
+    return prior.some(({ event }) => event.kind === "run_started" && JSON.stringify(event.attachments ?? []) === wanted);
+}
 /**
  * Build a kernel `add_history_message` payload from user attachments: a `user`
  * message whose content is the multimodal parts in the kernel's serde shape

package/dist/types/agent.d.ts

@@ -210,9 +210,17 @@ export interface WorkflowNodeOutcome {
     termination?: TerminationReason;
     output?: Message;
 }
+/** A control-plane request rejected before any workflow effect started. */
+export interface ControlRequestRejection {
+    operation: string;
+    subject?: string;
+    reason: string;
+}
 export interface WorkflowOutcome {
     nodeOutcomes: WorkflowNodeOutcome[];
     outputs: Record<string, string>;
+    /** Present when the workflow itself was rejected before any node ran. */
+    rejection?: ControlRequestRejection;
 }
 export declare function workflowNodeOutcomeFromKernel(raw: KernelWorkflowNodeOutcome): WorkflowNodeOutcome;
 /** Per-node spawn descriptor carried in the `workflow_batch_spawned` observation. */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@deepstrike/sdk",
-  "version": "0.2.41",
+  "version": "0.2.43",
   "description": "DeepStrike Node.js SDK",
   "type": "module",
   "main": "dist/index.js",
@@ -72,7 +72,7 @@
   },
   "dependencies": {
     "@anthropic-ai/sdk": "^0.99.0",
-    "@deepstrike/core": "0.2.41",
+    "@deepstrike/core": "0.2.43",
     "@google/generative-ai": "^0.24.1",
     "openai": "^5.23.2"
   },